Remove secret_token from publicly-visible source code

Bit of a shame that this is necessary, really. Web frameworks should be secure
by default.
Merge branch 'secret_token'